Опубликовано: 23 июл. 2025
Источник: github
Github: Прошло ревью
CVSS4: 7.8
CVSS3: 8.2
Описание
private-ip vulnerable to Server-Side Request Forgery
All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide an IP or hostname that resolves to a multicast IP address (224.0.0.0/4) which is not included as part of the private IP ranges in the package's source code.
Пакеты
Наименование
private-ip
npm
Затронутые версииВерсия исправления
<= 3.0.2
Отсутствует
Связанные уязвимости
CVSS3: 8.2
nvd
около 2 месяцев назад
All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide an IP or hostname that resolves to a multicast IP address (224.0.0.0/4) which is not included as part of the private IP ranges in the package's source code.